CVE-2026-57200

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57200", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T02:00:46.800Z", "datePublished": "2026-10-27T21:13:03.777Z", "dateUpdated": "2026-10-30T20:18:00.957Z"}, "containers": {"cna": {"title": "Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-wcvv-g26m-wx5c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-wcvv-g26m-wx5c"}, {"name": "https://github.com/asterisk/asterisk/commit/051d29a0d35559e9165bab346de9422e25415533", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/051d29a0d35559e9165bab346de9422e25415533"}, {"name": "https://github.com/asterisk/asterisk/commit/205c301a0a0b0d013d4ebdf12856ebbc30405350", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/205c301a0a0b0d013d4ebdf12856ebbc30405350"}, {"name": "https://github.com/asterisk/asterisk/commit/762b4c9c39b28fa5564112b0f484012298469a6c", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/762b4c9c39b28fa5564112b0f484012298469a6c"}, {"name": "https://github.com/asterisk/asterisk/commit/87641e9b2cd62c998c5283400ba77b61b5b07dd4", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/87641e9b2cd62c998c5283400ba77b61b5b07dd4"}, {"name": "https://github.com/asterisk/asterisk/commit/9d198a7d16ccba51507dfea6c1ecc511e89d698a", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/9d198a7d16ccba51507dfea6c1ecc511e89d698a"}, {"name": "https://github.com/asterisk/asterisk/commit/c10cdbce072a708060cd38a89d6850808fe6bf46", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/c10cdbce072a708060cd38a89d6850808fe6bf46"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"name": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "affected": [{"vendor": "asterisk", "product": "asterisk", "versions": [{"version": "< 20.20.1", "status": "affected"}, {"version": ">= 21.0.0-pre1, < 21.12.3", "status": "affected"}, {"version": ">= 22.0.0-pre1, < 22.10.1", "status": "affected"}, {"version": ">= 23.0.0-pre1, < 23.4.1", "status": "affected"}]}, {"vendor": "certified-asterisk", "product": "certified-asterisk", "versions": [{"version": ">= 22.8-cert1-pre1, < 22.8-cert3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T21:13:03.777Z"}, "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3."}], "source": {"advisory": "GHSA-wcvv-g26m-wx5c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T20:17:53.189674Z", "id": "CVE-2026-57200", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T20:18:00.957Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57200", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T20:17:53.189674Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T20:17:57.810Z"}}], "cna": {"title": "Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE", "source": {"advisory": "GHSA-wcvv-g26m-wx5c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "asterisk", "product": "asterisk", "versions": [{"status": "affected", "version": "< 20.20.1"}, {"status": "affected", "version": ">= 21.0.0-pre1, < 21.12.3"}, {"status": "affected", "version": ">= 22.0.0-pre1, < 22.10.1"}, {"status": "affected", "version": ">= 23.0.0-pre1, < 23.4.1"}]}, {"vendor": "certified-asterisk", "product": "certified-asterisk", "versions": [{"status": "affected", "version": ">= 22.8-cert1-pre1, < 22.8-cert3"}]}], "references": [{"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-wcvv-g26m-wx5c", "name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-wcvv-g26m-wx5c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/asterisk/asterisk/commit/051d29a0d35559e9165bab346de9422e25415533", "name": "https://github.com/asterisk/asterisk/commit/051d29a0d35559e9165bab346de9422e25415533", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/205c301a0a0b0d013d4ebdf12856ebbc30405350", "name": "https://github.com/asterisk/asterisk/commit/205c301a0a0b0d013d4ebdf12856ebbc30405350", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/762b4c9c39b28fa5564112b0f484012298469a6c", "name": "https://github.com/asterisk/asterisk/commit/762b4c9c39b28fa5564112b0f484012298469a6c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/87641e9b2cd62c998c5283400ba77b61b5b07dd4", "name": "https://github.com/asterisk/asterisk/commit/87641e9b2cd62c998c5283400ba77b61b5b07dd4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/9d198a7d16ccba51507dfea6c1ecc511e89d698a", "name": "https://github.com/asterisk/asterisk/commit/9d198a7d16ccba51507dfea6c1ecc511e89d698a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/c10cdbce072a708060cd38a89d6850808fe6bf46", "name": "https://github.com/asterisk/asterisk/commit/c10cdbce072a708060cd38a89d6850808fe6bf46", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "name": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "name": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "name": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "name": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "name": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "name": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T21:13:03.777Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57200", "state": "PUBLISHED", "dateUpdated": "2026-10-30T20:18:00.957Z", "dateReserved": "2026-06-24T02:00:46.800Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-27T21:13:03.777Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "asterisk", "vendor": "asterisk", "versions": [{"status": "affected", "version": "< 20.20.1"}, {"status": "affected", "version": ">= 21.0.0-pre1, < 21.12.3"}, {"status": "affected", "version": ">= 22.0.0-pre1, < 22.10.1"}, {"status": "affected", "version": ">= 23.0.0-pre1, < 23.4.1"}]}, {"product": "certified-asterisk", "vendor": "certified-asterisk", "versions": [{"status": "affected", "version": ">= 22.8-cert1-pre1, < 22.8-cert3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3."}], "id": "CVE-2026-57200", "lastModified": "2026-10-30T21:17:12.537", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57200", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T20:17:53.189674Z", "version": "2.0.3"}}]}, "published": "2026-10-27T21:18:06.843", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/051d29a0d35559e9165bab346de9422e25415533"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/205c301a0a0b0d013d4ebdf12856ebbc30405350"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/762b4c9c39b28fa5564112b0f484012298469a6c"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/87641e9b2cd62c998c5283400ba77b61b5b07dd4"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/9d198a7d16ccba51507dfea6c1ecc511e89d698a"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/c10cdbce072a708060cd38a89d6850808fe6bf46"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-wcvv-g26m-wx5c"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "asterisk: asterisk: arbitrary code execution via ARI authorization bypass", "id": "2562436", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562436"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-749", "details": ["Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.", "A flaw was found in Asterisk. This vulnerability allows an authenticated remote attacker with read-only permissions to achieve arbitrary code execution by bypassing authorization controls. Under conditions where the HTTP service is enabled and accessible, an attacker can submit unauthorized write requests through the Asterisk REST Interface (ARI) over WebSocket connections, permitting arbitrary module loading."], "name": "CVE-2026-57200", "public_date": "2026-10-27T21:13:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-57200\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57200\nhttps://github.com/asterisk/asterisk/commit/051d29a0d35559e9165bab346de9422e25415533\nhttps://github.com/asterisk/asterisk/commit/205c301a0a0b0d013d4ebdf12856ebbc30405350\nhttps://github.com/asterisk/asterisk/commit/762b4c9c39b28fa5564112b0f484012298469a6c\nhttps://github.com/asterisk/asterisk/commit/87641e9b2cd62c998c5283400ba77b61b5b07dd4\nhttps://github.com/asterisk/asterisk/commit/9d198a7d16ccba51507dfea6c1ecc511e89d698a\nhttps://github.com/asterisk/asterisk/commit/c10cdbce072a708060cd38a89d6850808fe6bf46\nhttps://github.com/asterisk/asterisk/releases/tag/20.20.1\nhttps://github.com/asterisk/asterisk/releases/tag/21.12.3\nhttps://github.com/asterisk/asterisk/releases/tag/22.10.1\nhttps://github.com/asterisk/asterisk/releases/tag/23.4.1\nhttps://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3\nhttps://github.com/asterisk/asterisk/security/advisories/GHSA-wcvv-g26m-wx5c\nhttps://github.com/asterisk/asterisk/tree/24.0.0-pre1"], "statement": "This vulnerability is rated as Important rather than Critical because exploitation requires authenticated read-only access to the Asterisk REST Interface alongside an exposed HTTP interface. If these non-default conditions are satisfied, unauthorized write operations can be issued to load external modules and compromise the host environment. Under default Asterisk configurations, the underlying web service remains inactive or restricted exclusively to the loopback interface, significantly reducing remote exposure.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,20.20.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0-pre1,21.12.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0-pre1,22.10.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0-pre1,23.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "asterisk", "source": "cna", "vendor": "asterisk"}, "product": "asterisk", "vendor": "asterisk"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": ">= 22.8-cert1-pre1, < 22.8-cert3"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 84.0, "source": "matching"}]}, "original": {"product": "certified-asterisk", "source": "cna", "vendor": "certified-asterisk"}, "product": "certified_asterisk", "vendor": "asterisk"}], "created": "2026-10-27T23:00:16.790639+00:00", "updated": "2026-11-02T14:00:08.963497+00:00", "vendors": ["asterisk", "asterisk$PRODUCT$asterisk", "asterisk$PRODUCT$certified_asterisk"]}